<!DOCTYPE doctype PUBLIC "-//W3C//DTD HTML 4.0 Frameset//EN">

<HTML>
  <HEAD>
    <META name="generator" content=
    "HTML Tidy for Java (vers. 2009-12-01), see jtidy.sourceforge.net">

    <TITLE>Search for Strings</TITLE>
    <META http-equiv="content-type" content="text/html; charset=windows-1252">
    <LINK rel="stylesheet" type="text/css" href="help/shared/DefaultStyle.css">
  </HEAD>

  <BODY>
    <H1>Search for Strings</H1>

    <P><I>Search for Strings</I> searches the entire program or a specific selection for possible
    <B><I>Ascii</I></B> or <B><I>Unicode</I></B> strings from the main menu. The results will be
    displayed in a table that can be filtered and sorted and provides actions for creating
    strings.</P>

    <H2><A name="String_Search_Dialog"></A><B>String Search Dialog</B></H2>

    <BLOCKQUOTE>
      <P>To search for strings, select <B>Search</B><IMG alt="" border="0" src=
      "help/shared/arrow.gif"> <B>For Strings...</B> This will bring up the String Search Dialog
      where you can configure the search criteria before initiating the search.</P>

      <P align="center"><IMG alt="" src="images/StringSearchDialog.png" border="0"></P>
    </BLOCKQUOTE>

    <H2><B>Search Options</B></H2>

    <BLOCKQUOTE>
      <UL>
        <LI><B>Minimum Length</B> - determines the shortest length of possible strings to
        display.<BR>
        </LI>

        <LI><B>Alignment</B> - indicates the search should only return results that start at an
        address with the indicated byte alignment.</LI>

        <LI><B>Require Null Termination</B> - if checked, the string resulting from the search must
        be null terminated. If not checked, the strings resulting from the search may or may not be
        null terminated.<BR>
        </LI>

        <LI><SPAN style="font-weight: bold;">Pascal Strings</SPAN> - if checked, only strings that
        are valid pascal, pascal 255 or pascal unicode strings will be found.<BR>
        </LI>

        <LI><B>Word Model</B> - specifies the Strings Analyzer model file used to detect
        high-confidence words. If this field is populated with a valid model file (default is
        'StringModel.sng'), the resulting table will contain an "Is Word" column and an option to
        filter by whether the string is a word or not.<BR>
        This field can be left blank and the word-related options will be omitted from the results
        table.<BR>
        <BR>
         User-defined models should be placed in the <B>Ghidra/Features/Base/data/stringngrams</B>
        directory.<BR>
        <BR>
        </LI>

        <LI><B>Memory Block Types</B> - Allows the user to specify if only loaded memory blocks
        should be searched for the strings, or all (unloaded + loaded).</LI>

        <LI><B>Selection Scope</B> - Allows the user to specify if the entire address space should
        be searched or only the user selection.</LI>

        <LI><B>Search</B> - press this button to find all strings using the current search
        options.</LI>
      </UL>
    </BLOCKQUOTE>

    <H2><A name="String_Search_Results"></A><B>String Search Results</B></H2>

    <BLOCKQUOTE>
      <P>The results are displayed in tabular format. Strings can be created by selecting one or
      more rows from the resulting table and pressing the <B>"Make String"</B> button or ascii
      arrays with the <B>"Make Ascii"</B> button. An offset for the string(s) start can be
      specified to change the starting location(s) past the beginning of the string. String(s) can
      be automatically labeled.</P>

      <P align="center"><IMG alt="" src="images/StringSearchResults.png" border="0"></P>
    </BLOCKQUOTE>

    <H2>Table Columns</H2>

    <BLOCKQUOTE>
      <UL>
        <LI>
          <B>Defined</B> - shows an icon that indicates the status of the string. 

          <UL>
            <LI><IMG alt="" src="images/font.png" border="0"> - indicates a string that has already
            been defined.</LI>

            <LI><IMG alt="" src="images/magnifier.png" border="0"> - indicates a string that is not
            defined.</LI>

            <LI><IMG alt="" src="images/dialog-warning.png" border="0"> - indicates a string that
            has been partially defined at some offset.</LI>

            <LI><IMG alt="" src="images/dialog-warning_red.png" border="0"> - indicates a string
            that conflicts with an instruction or some other data already defined at that
            address.</LI>
          </UL>
        </LI>

        <LI><B>Location</B> - The address of the found string.</LI>

        <LI><SPAN style="font-weight: bold;">Label</SPAN> - If one exists, the label at the
        location of the found string.</LI>

        <LI><SPAN style="font-weight: bold;">Preview</SPAN> - If data or code already exists, the
        representation of that code or data. If no code or data exists, the undefined byte at the
        location of the found string.</LI>

        <LI><SPAN style="font-weight: bold;">Ascii</SPAN> - What the string at the found location
        would look like if it were created.</LI>

        <LI><SPAN style="font-weight: bold;">String Type</SPAN> - What type of string has been
        found. Currently, we support ascii strings, unicode strings, pascal strings, pascal 255
        strings, and pascal unicode strings.<BR>
        </LI>

        <LI><SPAN style="font-weight: bold;">Length</SPAN> - The number of characters in the
        string.<BR>
        </LI>

        <LI><SPAN style="font-weight: bold;">Is Word</SPAN> - Whether the word model has
        determined, with high confidence, that the string is a valid word or sequence of words.
        NOTE: this table field is only available if the String Search Dialog 'Word Model' field
        contains a valid model file.<BR>
        </LI>
      </UL>
    </BLOCKQUOTE>

    <H2><A name="String_Filters"></A><B>String Filters</B></H2>

    <BLOCKQUOTE>
      <P>There are four toggle buttons in the table window's title bar that are used to control
      which strings are included in the table base on the strings "defined" state.</P>

      <UL>
        <LI><IMG alt="" src="images/font.png" border="0"> - toggles inclusion of <B>defined</B>
        strings.</LI>

        <LI><IMG alt="" src="images/magnifier.png" border="0"> - toggles inclusion of completely
        <B>undefined</B> strings.</LI>

        <LI><IMG alt="" src="images/dialog-warning.png" border="0"> - toggles inclusion of
        <B>partially defined</B> strings.</LI>

        <LI><IMG alt="" src="images/dialog-warning_red.png" border="0"> - toggles inclusion of
        strings that <B>conflict</B> with an instruction or some other data at the start
        address.</LI>

        <LI><IMG alt="" src="images/view-filter.png" border="0"> - toggles inclusion of
        <B>high-confidence word</B> strings. NOTE: this icon is only available if a String Search
        Dialog 'Word Model' field contains a valid model file.</LI>
      </UL>
    </BLOCKQUOTE>

    <H2><A name="Make_String_Options"></A><B>Make String Options</B></H2>

    <BLOCKQUOTE>
      <UL>
        <LI><B>Make String</B> - press this button to create either a string of the appropriate
        type (ascii or unicode) at the address(es) selected in the results table - if the option to
        automatically label is checked, a label will be placed at the beginning of the
        string(s).</LI>

        <LI><B>Make Char Array -</B> press this button to create an array of chars at the
        address(es) selected in the results table - if the option to automatically label is
        checked, a label will be placed at the beginning of the char array.</LI>

        <LI><B>Offset</B> - allows the user to specify a different starting point for the string or
        ascii array. The automatic label will reflect the changes in address and name. NOTE: This
        option is ignored for pascal strings because changing the offset would result in making the
        string an invalid pascal string.<BR>
        </LI>

        <LI><B>Auto Label</B> - if checked, a label will be created when the string is created,
        that matches the string</LI>

        <LI><B>Include Alignment Nulls</B> - if checked, strings will be created including any
        alignment nulls after the string, up to the alignment value.</LI>

        <LI><B>Truncate if Needed</B> - if checked, a truncated string will be created if the
        string conflicts with an existing instruction or data that exists internal to the string.
        Otherwise, no string will be created if a conflict exists.</LI>
      </UL>

      <P><IMG alt="" border="0" src="help/shared/note.png"> The "Make Strings" panel can be
      hidden/shown using the <IMG alt="" border="0" src="images/expand.gif"> / <IMG alt="" border=
      "0" src="images/collapse.gif"> toggle button at the end of the text filter.</P>
    </BLOCKQUOTE>

	<H2>Actions</H2>
	
	<BLOCKQUOTE>

	    <H3><A name="Refresh"></A>Refresh <IMG alt="" src="Icons.REFRESH_ICON" border="0"></H3>
	
	    <BLOCKQUOTE>
	      <P>This action will cause the table to reload. The table attempts to keep the table up to
	      date, but for efficiency reasons, not all external program changes will be accurately
	      reflected in the strings table if those changes result in a conflict or partially defined
	      string. A refresh will force the table to completely reload, resulting in accurate
	      results.</P>
	    </BLOCKQUOTE>
	
	    <H3>Make Selection <IMG alt="" border="0" src="Icons.MAKE_SELECTION_ICON"></H3>
	
	    <BLOCKQUOTE>
	      <P><I>See <A href="help/topics/Search/Query_Results_Dialog.htm#Make_Selection">Make
	      Selection</A></I>.</P>
	    </BLOCKQUOTE>
	
	    <H3>Selection Navigation <IMG border="0" src="images/locationIn.gif" alt=""></H3>
	
	    <BLOCKQUOTE>
	      <P><I>See <A href=
	      "help/topics/Search/Query_Results_Dialog.htm#Selection_Navigation">Selection
	      Navigation</A></I>.</P>
	    </BLOCKQUOTE>

	</BLOCKQUOTE>

    <P class="providedbyplugin">Provided By: <I>StringTablePlugin</I></P>
    
    <H3><A name="Encoded_Strings_Dialog"></A>Search For Encoded Strings</H3>

    <BLOCKQUOTE>
      <P>The <b>Encoded Strings Dialog</b> is an alternate way to find and
      create string instances in undefined data locations.  It allows setting the character
      set (charset) of the string to be created, as well as the ability to filter out byte
      sequences from the selected locations that are not valid strings.</P>
      <P>The <b>Encoded Strings Dialog</b> will initially allow the user to select the character set of the
      string to create, and displays a preview of the strings found in the current selection:</P>
    </BLOCKQUOTE>
    <DIV align="center">
      <CENTER>
        <TABLE border="0" width="100%">
          <TBODY>
            <TR>
              <TD align="center" width="100%"><IMG src="images/EncodedStringsDialog_initial.png"></TD>
            </TR>
          </TBODY>
        </TABLE>
      </CENTER>
    </DIV>
    
    <P><B>Advanced options</B></P>
    
    <BLOCKQUOTE>
      <P>Click the <b>Advanced...</b> and the <b>A-Z,&#x6211;&#x7684;...</B> (Filter by character scripts)
      buttons to show additional options that will allow filtering the selected byte range for
      strings containing specific scripts (alphabets) and also excluding strings that have
      properties that are unwanted.</P>
    </BLOCKQUOTE>
    <DIV align="center">
      <CENTER>
        <TABLE border="0" width="100%">
          <TBODY>
            <TR>
              <TD align="center" width="100%"><IMG src="images/EncodedStringsDialog_advancedoptions.png"></TD>
            </TR>
          </TBODY>
        </TABLE>
      </CENTER>
    </DIV>
    
    <P><B>Character Script filtering</B></P>

    <BLOCKQUOTE>
      <P>The <b>Script</b> drop-down list and the various <b>Allow Additional</b> toggle buttons
      control how strings are filtered based on the script (Latin, Cyrillic, Arabic, etc) of each
      of the characters found in the string.</P>
      <P>The script chosen in the drop-down list will limit the included strings to strings that
      include at least one character of the desired script.</P>
      <P>If no <b>Allow Additional</b> toggle buttons are pressed, included strings will be limited
      to strings that are solely comprised of characters from the chosen script (alphabet).  This
      would exclude strings that contain characters such as the space character or numeric characters
      (labeled as the <b>Common</b> script), which typically is not desired.  Select the <b>0-9,!?</b>
      toggle to allow those characters.</P>
      <P>The <b>A-Z</b> (Latin) toggle will allow Latin characters to be present in included
      strings.  This is redundant if the <b>Script</b> drop-down list is already set to Latin,
      but becomes useful when another script is chosen, to allow including strings that are a
      mixture of the selected script and Latin, which commonly occurs when strings have symbol
      names, scientific units, etc.</P>
      <P>The <b>Any</b> toggle will allow any additional script to be present in included strings.</P>
      <P>More advanced filtering logic can be had by creating a column
      filter using <b>Create Column Filter</b> button in the lower right corner of the preview area
      and filtering on the <b>Unicode Script</b> column.</P>
    </BLOCKQUOTE>
    
    <P><B>Exclude codec errors, non-standard control chars</B></P>
    
    <BLOCKQUOTE>
    	<P>The <b>Exclude codec errors</b> check box excludes strings that contain the Unicode
    	REPLACEMENT character, which is placed into decoded strings when the charset codec logic
    	encounters a byte or byte sequence that is invalid.  For example, the <b>US-ASCII</b>
    	charset will translate bytes greater than 0x7f into REPLACEMENT characters.</P>
    	<P>The <b>Exclude non-std ctrl chars</b> check box excludes strings that contain
    	characters that correspond to control characters in the range 1..31, but ignoring
    	common control characters such as tab, CR, LF.</P>
    </BLOCKQUOTE>
    	    
    
    <P><B>Exclude invalid strings</B></P>
    
    <BLOCKQUOTE>
    	<P>The <b>Exclude invalid strings</b> option tests each candidate string against a pre-built
    	trigram frequency model and rejects strings that score lower than a cut-off value.</P>
    	<P>The built-in string model file was trained with mostly english strings, and will
    	probably mark valid words from other languages as invalid.</P>
    </BLOCKQUOTE>
    
    <P><B>Misc options</B></P>
    
    <BLOCKQUOTE>
    	<P><b>Minimum Length</b> - excludes strings shorter than this (measured in characters, not
    	bytes)</P>
    	<P><b>Align start of string</b> - ensures strings start at a location that is evenly divisible
    	by the alignment requirements of the character size of the charset.</P>
    	<P><b>Truncate at ref</b> - ends strings early when there is an inbound reference to a
    	character inside the string.</P>
    </BLOCKQUOTE>    

    <P><B>Tip</B></P>
    
    <BLOCKQUOTE>
      <P>When an option is responsible for excluding / filtering-out a string, that option will
      have a red superscripted number next to it that contains the total count of strings
      excluded by that option.</P>
    </BLOCKQUOTE>
    
    <P><B>Related</B></P>
    
    <BLOCKQUOTE>
      <P>See the <a href="../ViewStringsPlugin/ViewStringsPlugin.htm">Defined Strings</a> window to see
      already created strings.</P>
    </BLOCKQUOTE>
    
    <P class="providedbyplugin">Provided By: <I>EncodedStringsPlugin</I></P>

    <P class="relatedtopic">Related Topics:</P>

    <UL>
      <LI><P class="relatedtopic"><A href="Search_Memory.htm">Search Memory</A></P></LI>
      <LI><P class="relatedtopic"><A href="Search_Memory.htm">Search Program Memory</A></P></LI>
      <LI><P class="relatedtopic"><A href="Search_Program_Text.htm">Search Program Text</A></P></LI>
      <LI><P class="relatedtopic"><A href="Searching.htm">Searching</A></P></LI>
    </UL>
	<br>
  </BODY>
</HTML>
